Command Injection in Ziroom ZHOME A0101

Executive Summary

This is a command injection vulnerability in Ziroom ZHOME A0101 1.0.1.0. The issue is in the /api/ZRnetwork/set_passwd endpoint where the password1 parameter is not properly sanitized before being passed to system commands. Attackers can inject malicious shell commands by manipulating this parameter, potentially leading to remote code execution on the device.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the /api/ZRnetwork/set_passwd endpoint. Monitor HTTP POST requests containing the password1 parameter with suspicious payloads like semicolons or command chaining. Inspect logs for os.execute() calls in ZRLanWanFun.lua.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the device with root privileges. This may allow file manipulation, password changes, reverse shells, or data theft. The attack requires root credentials but enables full control over the device remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables remote code execution on the Ziroom ZHOME device, which could allow unauthorized access to sensitive data. For GDPR, this may lead to unauthorized processing or disclosure of personal data, violating principles of data protection and user rights. Under HIPAA, if the device handles protected health information, this flaw could result in unauthorized access or disclosure, breaching security requirements for electronic protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Disable HTTP Basic Authentication for root access. Update firmware to a patched version if available. Restrict network access to the device via firewall rules. Monitor for unusual command execution patterns.

Useful 0 Not Useful 0